Skip to main content

Standard curve database



Technical requirements

  • For each of the bit-lengths 160,192,224,256,320,384,512160, 192, 224, 256, 320, 384, 512 one curve shall be proposed.
  • The base field size pp should be congruent to 3mod43 \mod 4.
  • The curve should be Fp\mathbb{F}_p-isomorphic to a curve with A3modpA \equiv -3 \mod p.
  • The prime pp must not be of a special form in order to avoid patented fast arithmetic on the base field.
  • The order of the curve E(Fp)\lvert \mathcal{E}(\mathbb{F}_p) \rvert should be smaller than the size of the base field pp.
  • The curve coefficient BB should be non-square in Fp\mathbb{F}_p.

Security requirements

  • The embedding degree l=min{tqdividespt1}l = \min\{t \vert q \text{divides} p^t - 1 \} should be large, where qq is the order of the basepoint and pp the size of the base field. Specifically, (q1)/l<100(q - 1) / l < 100.
  • The curves are not trace one curves. Specifically E(Fp)p\lvert \mathcal{E}(\mathbb{F}_p) \rvert \ne p.
  • The class number of the maximal order of the endomorphism ring of the curve is larger than 1000000010000000.
  • The group order E(Fp)\lvert \mathcal{E}(\mathbb{F}_p) \rvert should be a prime number qq.

Original method

Brainpool published their method of generating verifiably random curves in the ECC Brainpool Standard Curves and Curve Generation [1] document, along with generated domain parameters claimed to be generated using the presented method and seeds. However, the presented curves were (with the exception of the 512-bit curves) not generated using the presented method, as they have properties that can not result from the presented method of generating curves. See the BADA55 paper [3] for more information.

RFC 5639 method

Brainpool published an RFC with their fixed method of generating verifiably random curves and generated curves in RFC 5639 [2], which matches the generated curves and seeds.

Generating primes

Generating curves


  1. Manfred Lochter: ECC Brainpool Standard Curves and Curve Generation v. 1.0, [archive]
  2. Manfred Lochter, Johannes Merkle: Elliptic Curve Cryptography (ECC) Brainpool Standard Curves and Curve Generation (RFC5639)
  3. BADA55 Research Team: BADA55 Crypto - Brainpool curves

© 2020 Jan Jancar | Built with Dox theme for Gatsby